Merge branch 'main' into 4-dev

Paul-Bob · Paul-Bob · commit e34b47c7905f · 2026-03-31T19:02:38.000+03:00
diff --git a/.github/workflows/components-tests.yml b/.github/workflows/components-tests.yml
@@ -33,15 +33,12 @@ jobs:
     strategy:
       matrix:
         ruby:
-          - '3.1.4'
-          - '3.3.0'
+          - '3.3'
+          - '3.4'
         rails:
           - '6.1'
           - '7.1'
           - '8.0'
-        exclude:
-          - ruby: '3.1.4'
-            rails: '8.0'
     runs-on: ubuntu-latest
 
     env:
@@ -60,21 +57,12 @@ jobs:
     - name: Set up Ruby
       uses: ruby/setup-ruby@v1
       with:
-        # bundler-cache: true
+        bundler-cache: true
         bundler: default
         ruby-version: ${{ matrix.ruby }}
 
-    - uses: actions/cache@v4
-      with:
-        path: vendor/bundle
-        key: ${{ runner.os }}-test-gems-${{ hashFiles('**/Gemfile.lock') }}
-        restore-keys: |
-          ${{ runner.os }}-test-gems-${{ hashFiles('**/Gemfile.lock') }}
-
-    - name: Bundle install
+    - name: Prepare database
       run: |
-        bundle config path vendor/bundle
-        bundle install --jobs 4 --retry 3
         bin/rails db:create
         bin/rails db:migrate
 
diff --git a/.github/workflows/feature-tests.yml b/.github/workflows/feature-tests.yml
@@ -37,8 +37,8 @@ jobs:
     strategy:
       matrix:
         ruby:
-          - '3.3.0'
-          - '3.4.5'
+          - '3.3'
+          - '3.4'
         rails:
           - '7.1'
           - '8.0'
diff --git a/.github/workflows/i18n-tests.yml b/.github/workflows/i18n-tests.yml
@@ -35,10 +35,8 @@ jobs:
   i18n_tests:
     strategy:
       matrix:
-        ruby:
-          - '3.3.0'
-        rails:
-          - '8.0'
+        ruby: ['3.4']
+        rails: ['8.0']
     runs-on: ubuntu-latest
 
     env:
@@ -57,53 +55,15 @@ jobs:
     - name: Set up Ruby
       uses: ruby/setup-ruby@v1
       with:
-        # bundler-cache: true
+        bundler-cache: true
         bundler: default
         ruby-version: ${{ matrix.ruby }}
 
-    - uses: actions/cache@v4
-      with:
-        path: vendor/bundle
-        key: ${{ runner.os }}-test-gems-${{ hashFiles('**/Gemfile.lock') }}
-        restore-keys: |
-          ${{ runner.os }}-test-gems-${{ hashFiles('**/Gemfile.lock') }}
-
-    - name: Bundle install
+    - name: Prepare database
       run: |
-        bundle config path vendor/bundle
-        bundle install --jobs 4 --retry 3
         bin/rails db:create
         bin/rails db:migrate
 
-    - name: Get yarn cache directory path
-      id: test-yarn-cache-dir-path
-      run: echo "dir=$(yarn cache dir)" >> $GITHUB_OUTPUT
-
-    - uses: actions/cache@v4
-      id: test-yarn-cache
-      with:
-        path: ${{ steps.test-yarn-cache-dir-path.outputs.dir }}
-        key: ${{ runner.os }}-test-yarn-${{ hashFiles('**/yarn.lock') }}
-        restore-keys: |
-          ${{ runner.os }}-test-yarn-${{ hashFiles('**/yarn.lock') }}
-
-    - name: Yarn install the dummy app
-      run: |
-        cd spec/dummy
-        yarn
-
-    - name: Yarn install
-      run: yarn
-
-    - name: Build assets
-      env:
-        RAILS_ENV: production
-        NODE_ENV: production
-      run: |
-        yarn build:js
-        yarn build:css
-        yarn build:custom-js
-
     - name: Run tests
       id: run_tests
       run: bundle exec rspec spec/system/i18n_spec.rb
diff --git a/.github/workflows/system-tests.yml b/.github/workflows/system-tests.yml
@@ -36,8 +36,8 @@ jobs:
     strategy:
       matrix:
         ruby:
-          - '3.3.0'
-          - '3.4.5'
+          - '3.3'
+          - '3.4'
         rails:
           - '7.1'
           - '8.0'
@@ -59,21 +59,12 @@ jobs:
     - name: Set up Ruby
       uses: ruby/setup-ruby@v1
       with:
-        # bundler-cache: true
+        bundler-cache: true
         bundler: default
         ruby-version: ${{ matrix.ruby }}
 
-    - uses: actions/cache@v4
-      with:
-        path: vendor/bundle
-        key: ${{ runner.os }}-test-gems-${{ hashFiles('**/Gemfile.lock') }}
-        restore-keys: |
-          ${{ runner.os }}-test-gems-${{ hashFiles('**/Gemfile.lock') }}
-
-    - name: Bundle install
+    - name: Prepare database
       run: |
-        bundle config path vendor/bundle
-        bundle install --jobs 4 --retry 3
         bin/rails db:create
         bin/rails db:migrate
 
diff --git a/.github/workflows/test-tailwindcss-integration.yml b/.github/workflows/test-tailwindcss-integration.yml
@@ -21,26 +21,18 @@ jobs:
       with:
         repository: avo-hq/avo_tailwindcss_test_repo
 
-    - uses: actions/cache@v4
-      with:
-        path: vendor/bundle
-        key: ${{ runner.os }}-test-gems-${{ hashFiles('**/Gemfile.lock') }}
-        restore-keys: |
-          ${{ runner.os }}-test-gems-${{ hashFiles('**/Gemfile.lock') }}
-
     - name: Set up Ruby
       uses: ruby/setup-ruby@v1
       with:
+        bundler-cache: true
         bundler: default
         ruby-version: 3.3.0
 
-    - name: Bundle install
-      run: |
-        bundle config path vendor/bundle
-        bundle install --jobs 4 --retry 3
-
     - name: Add Avo
       run: |
+        # ruby/setup-ruby with bundler-cache runs Bundler in a frozen/deployment-like mode.
+        # This step intentionally changes the Gemfile.lock, so we must unfreeze Bundler here.
+        bundle config set frozen false
         bundle add "avo" --git='https://github.com/avo-hq/avo.git' --ref="${{ github.sha }}"
         bundle install
         bin/rails generate avo:install
diff --git a/Appraisals b/Appraisals
@@ -1,4 +1,4 @@
-["3.3.0", "3.4.5"].each do |ruby_version|
+["3.3", "3.4"].each do |ruby_version|
   ["7.1", "8.0"].each do |rails_version|
     appraise "rails-#{rails_version}-ruby-#{ruby_version}" do
       gem "psych", "< 4"
diff --git a/app/components/avo/referrer_params_component.html.erb b/app/components/avo/referrer_params_component.html.erb
@@ -4,5 +4,5 @@
 <%= hidden_field_tag :via_record_id, params[:via_record_id] if params[:via_record_id] %>
 <%= hidden_field_tag :via_relation, params[:via_relation] if params[:via_relation] %>
 <%= hidden_field_tag :via_belongs_to_resource_class, params[:via_belongs_to_resource_class] if params[:via_belongs_to_resource_class] %>
-<%= hidden_field_tag :return_to, params[:return_to] if params[:return_to].present? %>
+<%= hidden_field_tag :return_to, e(params[:return_to]) if params[:return_to].present? %>
 <%= hidden_field_tag :referrer, @back_path if params[:via_resource_class] %>
diff --git a/app/components/avo/views/resource_show_component.rb b/app/components/avo/views/resource_show_component.rb
@@ -54,7 +54,7 @@ def edit_path
     # When coming from a turbo frame, we don't want to return to that exact frame
     # for example when editing a has_one field we want to return to the parent frame
     # not the frame of the has_one field.
-    args[:return_to] = request.url unless request.url.include?("turbo_frame=")
+    args[:return_to] = e(request.fullpath) unless request.url.include?("turbo_frame=")
 
     helpers.edit_resource_path(record: @resource.record, resource: @resource, **args)
   end
diff --git a/app/controllers/avo/base_application_controller.rb b/app/controllers/avo/base_application_controller.rb
@@ -327,7 +327,6 @@ def raise_404
 
     def decode_params
       if params[:return_to].present?
-        params[:raw_return_to] = params[:return_to]
         params[:return_to] = d(params[:return_to])
       end
     end
diff --git a/app/controllers/avo/base_controller.rb b/app/controllers/avo/base_controller.rb
@@ -619,7 +619,9 @@ def redirect_path_from_resource_option(action = :after_update_path)
       return nil if @resource.class.send(action).blank?
 
       extra_args = {}
-      extra_args[:return_to] = params[:return_to] if params[:return_to].present?
+      if params[:return_to].present?
+        extra_args[:return_to] = e(params[:return_to])
+      end
 
       if @resource.class.send(action) == :index
         resources_path(resource: @resource, **extra_args)
diff --git a/app/helpers/avo/application_helper.rb b/app/helpers/avo/application_helper.rb
@@ -159,14 +159,16 @@ def container_classes
 
     # encode & encrypt params
     def e(value)
-      Avo::Services::EncryptionService.encrypt(message: value, purpose: :return_to, serializer: Marshal)
+      encrypted = Avo::Services::EncryptionService.encrypt(message: value, purpose: :return_to, serializer: Marshal)
+      Base64.urlsafe_encode64(encrypted, padding: false)
     end
 
     # decrypt & decode params
     def d(value)
-      Avo::Services::EncryptionService.decrypt(message: value, purpose: :return_to, serializer: Marshal)
+      decoded = Base64.urlsafe_decode64(value.to_s)
+      Avo::Services::EncryptionService.decrypt(message: decoded, purpose: :return_to, serializer: Marshal)
     rescue
-      value
+      nil
     end
 
     def wrap_in_modal(content)
diff --git a/app/javascript/application.js b/app/javascript/application.js
@@ -2,7 +2,8 @@
 import 'core-js/stable'
 // eslint-disable-next-line import/no-extraneous-dependencies
 import 'chartkick/chart.js/chart.esm'
-import 'mapkick/bundle'
+import Mapkick from 'mapkick'
+import mapboxgl from 'mapbox-gl'
 import 'regenerator-runtime/runtime'
 import * as ActiveStorage from '@rails/activestorage'
 import { Turbo } from '@hotwired/turbo-rails'
@@ -24,6 +25,8 @@ function installHotkeys(root = document) {
   })
 }
 
+Mapkick.use(mapboxgl)
+
 window.Avo.localStorage = new LocalStorageService()
 
 window.Turbolinks = Turbo
diff --git a/avo.gemspec b/avo.gemspec
@@ -45,6 +45,6 @@ Gem::Specification.new do |spec|
   spec.add_dependency "addressable"
   spec.add_dependency "meta-tags"
   spec.add_dependency "docile"
-  spec.add_dependency "prop_initializer", ">= 0.2.0"
+  spec.add_dependency "prop_initializer", ">= 0.3.0"
   spec.add_dependency "avo-icons", ">= 0.1.2"
 end
diff --git a/lib/avo.rb b/lib/avo.rb
@@ -1,5 +1,6 @@
 require "zeitwerk"
 require "net/http"
+require "active_support/inflector"
 require_relative "avo/version"
 require_relative "avo/engine" if defined?(Rails)
 
@@ -177,4 +178,4 @@ def 🥑
   Avo
 end
 
-loader.eager_load
+loader.eager_load if defined?(Rails)
diff --git a/lib/avo/asset_manager.rb b/lib/avo/asset_manager.rb
@@ -1,7 +1,5 @@
 module Avo
   class AssetManager
-    include ActionView::Helpers::AssetTagHelper
-
     attr_reader :stimulus_controllers
 
     def initialize
diff --git a/lib/avo/current.rb b/lib/avo/current.rb
@@ -1,3 +1,14 @@
+begin
+  require "active_support/isolated_execution_state"
+rescue LoadError
+  # Older ActiveSupport versions may not expose this file directly.
+end
+require "active_support/current_attributes"
+begin
+  require "active_support/code_generator"
+rescue LoadError
+  # ActiveSupport 6.1 does not have this file.
+end
 class Avo::Current < ActiveSupport::CurrentAttributes
   attribute :app
   attribute :license
diff --git a/lib/avo/discreet_information.rb b/lib/avo/discreet_information.rb
@@ -1,3 +1,5 @@
+require "prop_initializer"
+require "action_view/helpers"
 class Avo::DiscreetInformation
   extend PropInitializer::Properties
   include ActionView::Helpers::TagHelper
diff --git a/lib/avo/fields/concerns/has_html_attributes.rb b/lib/avo/fields/concerns/has_html_attributes.rb
@@ -56,7 +56,7 @@ def parse_html
         end
 
         def default_attribute_value(name)
-          (name == :data) ? {} : ""
+          (name == :data) ? {} : nil
         end
 
         def add_action_data_attributes(attributes, name, element)
diff --git a/lib/avo/resources/array_resource.rb b/lib/avo/resources/array_resource.rb
@@ -93,6 +93,10 @@ def fetch_records(array_of_records = nil)
               define_method(:to_param) do
                 id
               end
+
+              class << self
+                def class_name = class_name
+              end
             end
           )
 
diff --git a/package.json b/package.json
@@ -52,7 +52,7 @@
     "codemirror": "5.65.20",
     "core-js": "^3.46.0",
     "css-loader": "^6.11.0",
-    "dompurify": "^3.3.0",
+    "dompurify": "^3.3.3",
     "easymde": "^2.20.0",
     "esbuild": "^0.25.11",
     "eslint-config-airbnb": "^19.0.4",
@@ -63,6 +63,7 @@
     "js-cookie": "^3.0.5",
     "lodash": "^4.17.21",
     "luxon": "^3.7.2",
+    "mapbox-gl": "1.13.3",
     "mapkick": "^0.2.6",
     "postcss": "^8.5.6",
     "postcss-flexbugs-fixes": "^5.0.2",
@@ -79,7 +80,7 @@
     "tailwindcss": "^4.1.17",
     "tailwindcss-stimulus-components": "^3.0.4",
     "tippy.js": "^6.3.7",
-    "trix": "^2.1.16",
+    "trix": "^2.1.17",
     "turbo_power": "^0.6.2",
     "urijs": "^1.19.11"
   },
diff --git a/spec/dummy/app/controllers/csp_reports_controller.rb b/spec/dummy/app/controllers/csp_reports_controller.rb
@@ -0,0 +1,15 @@
+class CspReportsController < ActionController::Base
+  skip_before_action :verify_authenticity_token, only: :create
+
+  def create
+    payload = request.raw_post.presence || "{}"
+    parsed_payload = JSON.parse(payload)
+
+    Rails.logger.warn("[CSP REPORT] #{JSON.pretty_generate(parsed_payload)}")
+
+    head :no_content
+  rescue JSON::ParserError
+    Rails.logger.warn("[CSP REPORT] Unparseable payload: #{payload}")
+    head :bad_request
+  end
+end
diff --git a/spec/dummy/config/initializers/content_security_policy.rb b/spec/dummy/config/initializers/content_security_policy.rb
diff --git a/spec/dummy/config/routes.rb b/spec/dummy/config/routes.rb
diff --git a/spec/features/avo/require_avo_smoke_spec.rb b/spec/features/avo/require_avo_smoke_spec.rb
diff --git a/spec/system/avo/alert_backtrace_spec.rb b/spec/system/avo/alert_backtrace_spec.rb
diff --git a/spec/system/avo/app_spec.rb b/spec/system/avo/app_spec.rb
diff --git a/spec/system/avo/open_field_attachment_spec.rb b/spec/system/avo/open_field_attachment_spec.rb

-Original file line number
+Diff line change
     strategy:
       matrix:
         ruby:
 -          - '3.3.0'
 -          - '3.4.5'
 +          - '3.3'
 +          - '3.4'
         rails:
           - '7.1'
           - '8.0'
Original file line number	Diff line number	Diff line change
`@@ -1,4 +1,4 @@`
`1`		`-["3.3.0", "3.4.5"].each do \|ruby_version\|`
	`1`	`+["3.3", "3.4"].each do \|ruby_version\|`
`2`	`2`	`["7.1", "8.0"].each do \|rails_version\|`
`3`	`3`	`appraise "rails-#{rails_version}-ruby-#{ruby_version}" do`
`4`	`4`	`gem "psych", "< 4"`